– The IPS 4510 and IPS 4520 are supported in IPS 7.1(4)E4 and later., IPS 7.2(1)E4 and later, and IPS 7.3(1)E4 and later. The IPS 4520-XL is supported in IPS 7.2(1)E4 and later, and IPS 7.3(1)E4 and later.

– On the IPS 4500 series, no interface-related configurations are allowed when the SensorApp is down.

– The ASA 5500 AIP SSC-5 is only supported in IPS 6.2(
x
).

– The ASA 5500 AIP SSC-5 does not support creating custom signatures, adding signatures, or cloning signatures. You can tune (edit) existing signatures.

New and Changed Information

In the SNMPv3 Users pane you can add, edit, and delete SNMPv3 users. The SNMPv3 Users pane displays the username, access control, security level, authentication protocol, and privacy protocol for all SNMPv3 users configured on the system. You can configure a maximum of 25 SNMPv3 users on the system. You can also associate SNMPv3 users with SNMP trap destinations. If no SNMPv3 user is associated with a trap, then an SNMPv2 trap is sent.

A new pane, SDEE Subscription, has been added to Sensor Management.

The SDEE Subscriptions pane displays the details of the SDEE client subscriptions on the sensor. You can view the SDEE subscription ID, the status (expired or valid) of the subscription, the IP address of each SDEE client for each listed subscription, and see the last time the subscription was read.

In IPS versions before 7.2(2)E4, a valid password is 8 to 32 characters long. For IPS 7.2(2)E4 and later, a valid password is 6 to 127 characters long.

In IPS versions before 7.2(2)E4, while executing an immediate upgrade, you cannot use the IDM, IME, or CLI, or start any new sessions until the upgrade is complete. For IPS 7.2(2)E4 and later, you can use the IDM, IME, and CLI immediately after an automatic update because the automatic update is now executed as background process.

Obtaining Software on Cisco.com

You can find major and minor updates, service packs, signature and signature engine updates, system and recovery files, firmware upgrades, and Readmes on the Download Software site on Cisco.com. Signature updates are posted to Cisco.com approximately every week, more often if needed. Service packs are posted to Cisco.com in a release train format, a new release every three months. Major and minor updates are also posted periodically. Check Cisco.com regularly for the latest IPS software.

You must have an account with cryptographic access before you can download software. You set this account up the first time you download IPS software from the Download Software site.

Note You must be logged in to Cisco.com to download software. You must have an active IPS maintenance contract and a Cisco.com password to download software. You must have a sensor license to apply signature updates.

Step 6 In the Download Software window, choose
IPS Appliances > Cisco Intrusion Prevention System
and then click the version you want to download.

Note You must have an IPS subscription service license to download software.

Step 7 Click the type of software file you need. The available files appear in a list in the right side of the window. You can sort by file name, file size, memory, and release date. And you can access the Release Notes and other product documentation.

Step 8 Click the file you want to download. The file details appear.

Step 9 Verify that it is the correct file, and click
Download
.

Step 10 Click
Agree
to accept the software download rules. The File Download dialog box appears. The first time you download a file from Cisco.com, you must fill in the Encryption Software Export Distribution Authorization form before you can download the software.

b. Read the policy and click
I Accept
. The Encryption Software Export/Distribution Form appears.

If you previously filled out the Encryption Software Export Distribution Authorization form, and read and accepted the Cisco Systems Inc. Encryption Software Usage Handling and Distribution Policy, these forms are not displayed again.

Step 11 Open the file or save it to your computer.

Step 12 Follow the instructions in the Readme or the Release Notes to install the update.

Installing or Upgrading Cisco IME and Migrating Data Into IME

Note Beginning with IME 7.0.3, you are required to create a password to access the IME.

Cisco IEV, Cisco IOS IPS, and CSM

If you have a version of Cisco IPS Event Viewer installed, the Install wizard prompts you to remove it before installing the IME.

The IME event monitoring is also supported in IOS-IPS versions that support the Cisco IPS 5.x/6.x signature format. We recommend IOS-IPS 12.4(15)T4 if you intend to use the IME to monitor an IOS IPS device. Some of the new IME functionality including health monitoring is not supported.

Caution Do not install the IME on top of existing installations of CSM. You must uninstall CSM before installing the IME.

Installation Notes and Caveats

Note If you are using Windows 7 or Windows Server 2008, uninstall any earlier version of the IME before upgrading it. Otherwise, just upgrade from your current IME version.

Observe the following when installing or upgrading the IME:

• You can install the IME over all versions of the IME but not over IEV. All alert database and user settings are preserved.

The IME detects previous versions of IEV and prompts you to manually remove the older version before installing the IME or to install the IME on another system. The installation program then stops.

Make sure you close any open instances of the IME before upgrading to a new version of the IME.

Disable any anti-virus or host-based intrusion detection software before beginning the installation, and close any open applications. The installer spawns a command shell application that may trigger your host-based detection software, which causes the installation to fail.

You must be administrator to install the IME.

The IME coexists with other instances of the MySQL database. If you have a MySQL database installed on your system, you do NOT have to uninstall it before installing the IME.

Installing or Upgrading the IME

To install the IME, follow these steps:

Step 1 From the Download Software site on Cisco.com, download the IME executable file to your computer, or start the IDM in a browser window, and under Cisco IPS Manager Express, click
download
to install the IME executable file. IME-7.2.6.exe is an example of what the IME executable file might look like.

Step 2 Double-click the executable file. The Cisco IPS Manager Express - InstallShield Wizard appears. You receive a warning if you have a previous version of Cisco IPS Event Viewer installed. Acknowledge the warning, and exit installation. Remove the older version of IEV, and then continue the IME installation.

Step 3 Click
Next
to start the IME installation.

Step 4 Accept the license agreement and click
Next
.

Step 5 Click
Next
to choose the destination folder, click
Install
to install the IME, and then click
Finish
to exit the wizard. The Cisco IME and Cisco IME Demo icons are now on your desktop.

Note The first time you start the IME, you are prompted to set up a password.

Migrating IEV Data

To migrate IEV 5.
x
events to the IME, you must exit the installation and manually export the old events by using the IEV 5.
x
export function to move the data to local files. After installing the IME, you can import these files to the new IME system.

Note The IME does not support import and migration functions for IEV 4.x.

Creating and Changing the IME Password

Note Beginning with IME 7.0.3, you are required to create a password to access the IME.

When you start the IME for the first time, the Password Policy dialog box appears. Enter a password that you will use to access the IME. Reenter the password to confirm, and then click
OK
. From now on when you log in to the IME, enter your password in the Enter IME password field and click
OK
. To change the IME password, choose
Tools > Change User Password
, and enter your existing password, your new password, and then reenter the new password to confirm. When you uninstall and reinstall the IME, you must create a new user password. You do not have to restart the IME after a password change.

Note The IME does not support user roles or multiple sessions, so you do not need to configure a user name.

Password Requirements

The IME password has the following requirements:

Must contain at least 8 characters and no more than 80.

• Must contain characters from at least three of the following classes:

– Lower case letters

– Upper case letters

– Digits

– Special characters (! @ $ % & *)

No single character repeated more than two times consecutively.

All input must be ASCII characters.

Note The IME performs other checks to make sure that the password is secure. You receive an error message if the password does not pass validation.

Note This example location may be different depending on which Windows version you have.

Step 3 Restart the IME client.

Step 4 You are prompted to create a new password.

No events are lost from the database, including new events between the time you deleted hosts.cfg and restarted the IME. However, the event account user name and password will be used for both events and configuration. If you had different user names and passwords for the event and configuration roles, you must edit each device to restore them.

Cisco Security Intelligence Operations

The Cisco Security Intelligence Operations site on Cisco.com provides intelligence reports about current vulnerabilities and security threats. It also has reports on other security topics that help you protect your network and deploy your security systems to reduce organizational risk.

You should be aware of the most recent security threats so that you can most effectively secure and manage your network. Cisco Security Intelligence Operations contains the top ten intelligence reports listed by date, severity, urgency, and whether there is a new signature available to deal with the threat.

Restrictions and Limitations

You can use the IME to monitor sensors running Cisco IPS 5.0 and later; however, some of the new features and functionality in IME are only supported on sensors running IPS 6.1 or later.

IME 7.2.6 does not support Cisco IPS 4.
x
or 3.
x
sensors.

You can install IME 7.2.6 over all versions of the IME but not over IEV. All alert database and user settings are preserved.

IME 7.2.6 detects previous versions of IEV and prompts you to manually remove the older version before installing IME 7.2.6 or to install the IME on another system. The installation program then stops.

• Make sure you close any open instances of the IME before upgrading to IME 7.2.6.

Note If you are using Windows 7 or Windows Server 2008, uninstall any earlier version of the IME before upgrading. Otherwise, just upgrade from your current IME version.

Disable any anti-virus or host-based intrusion detection software before beginning the installation, and close any open applications. The installer spawns a command shell application that may trigger your host-based detection software, which causes the installation to fail.

You must be administrator to install the IME.

IME 7.2.6 coexists with other instances of the MySQL database. If you have a MySQL database installed on your system, you do NOT have to uninstall it before installing IME 7.2.6.

For IPS 5.0 and later, you can no longer remove the
cisco
account. You can disable it using the
no password cisco
command, but you cannot remove it. To use the
no password cisco
command, there must be another administrator account on the sensor. Removing the
cisco
account through the service account is not supported. If you remove the
cisco
account through the service account, the sensor most likely will not boot up, so to recover the sensor you must reinstall the sensor system image.

The IME launches MySDN from the last browser window you opened, which is the default setting for Windows. To change this default behavior, in Internet Explorer, choose
Tools > Internet Options
, and then click the
Advanced
tab. Scroll down and uncheck the
Reuse windows for launching shortcuts
check box.

Subscribe to
What’s New in Cisco Product Documentation
, which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks
. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)